Compliance guides for software teams
What each framework asks for, who it applies to and how it changes the way you build software. Each guide links the official text and counts the OceanLab product builds that cite it.
Pick a framework. Each guide covers the key duties, the engineering controls behind them and the builds that cite it.
- HIPAAWhat the HIPAA Privacy, Security and Breach Notification Rules ask of a product that handles US health data, and the engineering controls that make it possible to meet them.8 builds cite it
- SOC 2What a SOC 2 report is, why customers ask for one and which engineering controls auditors look at, from access reviews to change management.9 builds cite it
- GDPRWhat the GDPR asks of software that handles personal data of people in the EU, from lawful basis and data rights to privacy by design, breach notice and transfers.140 builds cite it
- PCI DSSWhat PCI DSS asks of any system that touches card data, how to keep that system as small as possible, and the controls inside it.32 builds cite it
- EU AI ActHow the EU AI Act sorts AI systems by risk, what providers and deployers must do in each tier, and when each part applies.16 builds cite it
- 21 CFR Part 11What the FDA asks of software that keeps regulated records or takes electronic signatures, from audit trails and validation to how a signature is linked to its record.6 builds cite it
- EU MDRWhen software counts as a medical device in the EU, how Rule 11 sets its class, and what a manufacturer must do before and after the product reaches patients.9 builds cite it
- FHIR and HL7How health systems exchange data today: HL7 v2 messages inside hospitals, FHIR APIs between apps, and the US rules that make FHIR access a requirement.8 builds cite it
- DORAWhat the EU Digital Operational Resilience Act asks of financial firms and their technology providers: managing ICT risk, reporting major incidents on a clock, testing, and controlling third-party providers.8 builds cite it
- MiCAHow the EU's Markets in Crypto-Assets Regulation licenses crypto-asset service providers, what it asks of issuers and custody, and how the travel rule changes every transfer.4 builds cite it
- PSD2How the EU's second Payment Services Directive shapes login and checkout with strong customer authentication, opens bank accounts to licensed third parties, and sets who pays when a payment was not authorised.21 builds cite it
Two ways to work with OceanLab
Project build
We design and build the system as one project. It starts with a clickable prototype your team tries before any production code is written. Pay per milestone (outcome-based) or hourly at $30-50/hr, depending on role and seniority.
Embedded engineers
Our engineers join your team on a flexible monthly retainer. Part-time is fine and it runs month to month, with hours that overlap the US, UK and Europe, the Middle East, and Australia and Asia. Outcome-based or $30-50/hr.
Questions
Are these guides legal advice?
No. They are guidance for software teams, written in plain words, with links to the official text. Talk to your own legal or compliance advisor before you rely on them.
Which framework applies to my product?
It depends on the data you handle, what the product does and where your users are. Health data in the US points to HIPAA, card payments to PCI DSS, personal data of people in the EU to the GDPR, AI used in the EU to the EU AI Act, and enterprise customers asking for proof of security to SOC 2. Software with a medical purpose in the EU points to the EU MDR, FDA-regulated records to 21 CFR Part 11, and health data exchange to FHIR and HL7. EU payments point to PSD2, crypto services to MiCA, and ICT at EU financial firms to DORA. Many products need more than one.
Where do the build counts come from?
They are counted from OceanLab's published case studies. Each study lists the rules it was built for, and a build counts when that list names the framework.
